<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 11/30/2012 10:09 AM, Longina Przybyszewska wrote:
<blockquote
cite="mid:84B3E55FE25BE542A37420D946B1372F03B3A8@ADM-EXMBX10B.adm.c.sdu.dk"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
        {font-family:Wingdings;
        panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:Wingdings;
        panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:Consolas;
        panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0cm;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman","serif";
        color:#000066;}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
pre
        {mso-style-priority:99;
        mso-style-link:"HTML Preformatted Char";
        margin:0cm;
        margin-bottom:.0001pt;
        font-size:10.0pt;
        font-family:"Courier New";
        color:#000066;}
span.HTMLPreformattedChar
        {mso-style-name:"HTML Preformatted Char";
        mso-style-priority:99;
        mso-style-link:"HTML Preformatted";
        font-family:Consolas;
        color:#000066;}
span.EmailStyle19
        {mso-style-type:personal-reply;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-size:10.0pt;}
@page WordSection1
        {size:612.0pt 792.0pt;
        margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif][if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">This is a good question.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Is it wrong?<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Computer should always have valid TGT .<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">What happens if computer’s TGT expires – or
rather , if it expires does user still have access to all
services?<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Do I need some tuning in config to prevent
that?<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<div style="border-width: medium medium 1pt; border-style: none
none solid; border-color: -moz-use-text-color
-moz-use-text-color windowtext; -moz-border-top-colors: none;
-moz-border-right-colors: none; -moz-border-bottom-colors:
none; -moz-border-left-colors: none; -moz-border-image: none;
padding: 0cm 0cm 1pt;">
<p class="MsoNormal" style="border:none;padding:0cm"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">I catched in ldap_child.log precise change
from preauthentication success</span><span
style="font-size:11.0pt;font-family:Wingdings;color:#1F497D"
lang="EN-US">à</span><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"> preauthentication faile<o:p></o:p></span></p>
<p class="MsoNormal" style="border:none;padding:0cm"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal" style="border:none;padding:0cm"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">ls –l /etc/krb5.keytab<o:p></o:p></span></p>
<p class="MsoNormal" style="border: medium none; padding:
0cm;"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);" lang="EN-US">-rw------- 1 root root 894 Nov
07:48 /etc/krb5.keytab</span></p>
</div>
</div>
</blockquote>
<br>
<br>
If you are asking in the context of SSSD then SSSD just handles the
renewal of the ticket for the host automatically for its purposes
only.<br>
But this does not mean that it makes sure that host TGT is always
available. Do you need to use host TGT for something else other than
SSSD for example for cron jobs? If so then you need to periodically
do kinit with host principal using host keytab.<br>
In future there will be a process called GSS proxy that would be
able to do it on demand on your behalf.<br>
<br>
<blockquote
cite="mid:84B3E55FE25BE542A37420D946B1372F03B3A8@ADM-EXMBX10B.adm.c.sdu.dk"
type="cite">
<div class="WordSection1">
<div
style="mso-element:para-border-div;border:none;border-bottom:solid
windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoNormal" style="border:none;padding:0cm"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal" style="border:none;padding:0cm"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal" style="border:none;padding:0cm"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [main] (0x2000): getting TGT sync<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [ldap_child_get_tgt_sync]
(0x2000): Kerberos context initialized<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [ldap_child_get_tgt_sync]
(0x2000): got realm_name: [NAT.C.SDU.DK]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [ldap_child_get_tgt_sync]
(0x0100): Principal name is: [<a class="moz-txt-link-abbreviated" href="mailto:VICTORIA$@NAT.C.SDU.DK">VICTORIA$@NAT.C.SDU.DK</a>]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [ldap_child_get_tgt_sync]
(0x0100): Using keytab [default]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [ldap_child_get_tgt_sync]
(0x2000): keytab ccname:
[<a class="moz-txt-link-freetext" href="FILE:/var/lib/sss/db/ccache_NAT.C.SDU.DK">FILE:/var/lib/sss/db/ccache_NAT.C.SDU.DK</a>]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [ldap_child_get_tgt_sync]
(0x2000): credentials initialized<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [ldap_child_get_tgt_sync]
(0x2000): credentials stored<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [ldap_child_get_tgt_sync]
(0x2000): Got KDC time offset<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [prepare_response] (0x0400):
Building response for result [0]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [pack_buffer] (0x2000): response
size: 60<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [pack_buffer] (0x1000): result
[0] krberr [0] msgsize [40] msg
[<a class="moz-txt-link-freetext" href="FILE:/var/lib/sss/db/ccache_NAT.C.SDU.DK">FILE:/var/lib/sss/db/ccache_NAT.C.SDU.DK</a>]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:26:54 2012)
[[sssd[ldap_child[7809]]]] [main] (0x0400): ldap_child
completed successfully<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [main] (0x0400): ldap_child
started.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [main] (0x2000): context
initialized<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [unpack_buffer] (0x1000): total
buffer size: 37<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [unpack_buffer] (0x1000):
realm_str size: 12<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [unpack_buffer] (0x1000): got
realm_str: NAT.C.SDU.DK<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [unpack_buffer] (0x1000):
princ_str size: 9<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [unpack_buffer] (0x1000): got
princ_str: VICTORIA$<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [unpack_buffer] (0x1000):
keytab_name size: 0<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [unpack_buffer] (0x1000):
lifetime: 86400<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 07:46:44 2012)
[[sssd[ldap_child[7867]]]] [main] (0x2000): getting TGT
sync:<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [unpack_buffer] (0x1000):
keytab_name size: 0<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [unpack_buffer] (0x1000):
lifetime: 86400<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [main] (0x2000): getting TGT sync<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [ldap_child_get_tgt_sync]
(0x2000): Kerberos context initialized<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [ldap_child_get_tgt_sync]
(0x2000): got realm_name: [NAT.C.SDU.DK]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [ldap_child_get_tgt_sync]
(0x0100): Principal name is: [<a class="moz-txt-link-abbreviated" href="mailto:VICTORIA$@NAT.C.SDU.DK">VICTORIA$@NAT.C.SDU.DK</a>]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [ldap_child_get_tgt_sync]
(0x0100): Using keytab [default]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [ldap_child_get_tgt_sync]
(0x2000): keytab ccname:
[<a class="moz-txt-link-freetext" href="FILE:/var/lib/sss/db/ccache_NAT.C.SDU.DK">FILE:/var/lib/sss/db/ccache_NAT.C.SDU.DK</a>]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [ldap_child_get_tgt_sync]
(0x0010): Failed to init credentials: Preauthentication
failed<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [main] (0x0020):
ldap_child_get_tgt_sync failed.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [prepare_response] (0x0400):
Building response for result [-1765328360]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [pack_buffer] (0x2000): response
size: 44<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [pack_buffer] (0x1000): result
[14] krberr [-1765328360] msgsize [24] msg
[Preauthentication failed]<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8137]]]] [main] (0x0400): ldap_child
completed successfully<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">(Thu Nov 29 08:14:09 2012)
[[sssd[ldap_child[8138]]]] [main] (0x0400): ldap_child
started.<o:p></o:p></span></p>
<div
style="mso-element:para-border-div;border:none;border-bottom:solid
windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm">
<p class="MsoNormal" style="border:none;padding:0cm"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Longina<o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"
lang="EN-US">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"
lang="EN-US"> <a class="moz-txt-link-abbreviated" href="mailto:sssd-users-bounces@lists.fedorahosted.org">sssd-users-bounces@lists.fedorahosted.org</a>
[<a class="moz-txt-link-freetext" href="mailto:sssd-users-bounces@lists.fedorahosted.org">mailto:sssd-users-bounces@lists.fedorahosted.org</a>] <b>On
Behalf Of </b>Ondrej Valousek<br>
<b>Sent:</b> 29. november 2012 14:27<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a><br>
<b>Subject:</b> Re: [SSSD-users] problems sssd-1.9.2<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal">Why do you need a TGT generated from a
machine account principal?<br>
Use your own instead.<br>
<br>
O.<br>
<br>
On 11/29/2012 12:12 PM, Longina Przybyszewska wrote: <o:p></o:p></p>
<pre>Can sssd do it for me ? Do I miss some options configured properly ?<o:p></o:p></pre>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
sssd-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>